1. Who controls your information
padelduels is owned and operated by XPO8 Limited (“XPO8”, “we”, “us”), a company incorporated in Hong Kong, of 1603, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong Island, Hong Kong. XPO8 is the controller of the personal data described in this policy, and the data user under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486). You can contact us about privacy at contact@padelduels.com.
This policy sits alongside the terms of service and the community rules.
2. Scope
This policy covers the padelduels website and apps, and the emails and notifications we send. It applies to visitors, players, hosts, coaches, centre owners and staff, and people whose details a centre records for a booking made at its desk.
It does not cover centres' or coaches' own websites, or Stripe's and Google's services, which have their own privacy policies.
3. The role of centres, coaches and Stripe
- Centres. When you book a court, the centre receives your username, the email address on your account and the booking details so it can run your booking. Centres also record the name, email and phone number of customers who book at their desk. Each centre is responsible for how it uses these details in its own systems, under its own privacy notice.
- Coaches. When you request a lesson, the coach sees your username, the service and time you chose, and your note. Coaches are responsible for how they use lesson details outside padelduels.
- Stripe. Online payments are taken by Stripe on behalf of the centre or coach, who is the seller. Stripe receives your email address and payment details, shares them with the centre or coach in their Stripe account, and handles the identity checks that centres and coaches complete to accept payments. Stripe does this under the Stripe privacy policy. padelduels never sees your full card details.
4. Information we collect
- Account: your email address and password, which our authentication provider stores in hashed form. If you sign in with Google, Google shares your email address and basic profile with us.
- Profile: username, home city and country, skill level, league, optional recurring availability, and a private search area.
- Playing: games you host or join, invitations, results, attendance cases, ratings, standings, friends and blocks.
- Messages and reviews: direct, game, coach and centre messages, reports, appeals, and coach reviews.
- Bookings and lessons: court or service, time, price, currency, payment method, payment and refund status, your lesson note, and Stripe payment references.
- Centres: business and contact details, address and map location, description, facilities, photos, courts, prices, opening hours, owner and staff email addresses, Stripe account status, and the customer details staff enter for desk bookings.
- Coaches: headline, description, qualifications, services and prices, venues, contact details, photos and Stripe account status.
- Technical: IP address, browser and device information and request logs kept by our providers, your device's timezone, and an approximate location, as explained below.
5. Sensitive information
We do not ask for health information, ethnic origin, religious or political beliefs, or other sensitive categories of data. Please do not put them in your profile, messages, notes or reviews. A report may need to describe an incident, such as an injury or abusive behaviour; include only what is needed for the review. We may remove sensitive information that is not needed.
6. Where information comes from
- From you, when you create an account, set up a profile, listing or centre, play, book, message or report.
- From other players, when they invite you, record a result, report an attendance case, message you or review a coach.
- From centres and coaches, when they accept, change or cancel a booking or lesson, reply to you, or record a desk booking.
- From Stripe, about payments, refunds and disputes, and whether a centre's or coach's account can accept payments.
- From Google, when you sign in with Google, search for a place, or allow device location.
- From our hosting provider, which can supply an approximate city based on your IP address.
7. How we use information
- To run padelduels: accounts, game discovery and matching, results, ratings and leaderboards, bookings, lessons, messages, notifications and reminders.
- To handle payments: starting Stripe Checkout, confirming payments, recording refunds and calculating platform fees.
- To keep people safe: reviewing reports and appeals, enforcing the community rules, and preventing fraud, spam and abuse.
- To keep the Service secure and reliable, fix problems, and understand how it is used in aggregate.
- To comply with the law, respond to lawful requests, and establish or defend legal claims.
Skill ratings, leagues and standings are calculated automatically from finalised results. A late withdrawal or late host cancellation automatically triggers the participation restriction described in the community rules; a no-show needs confirmation from another participant or an administrator. You can appeal attendance decisions in Settings, and an administrator reviews them.
We do not sell personal data, show advertising, or build advertising profiles.
8. Legal bases
Where laws such as the EU or UK General Data Protection Regulation apply, we rely on:
- Contract: to provide your account, games, bookings, lessons, messages and notifications.
- Legitimate interests: to keep padelduels safe and fair, including moderation, fraud prevention, security logs and keeping pseudonymous match history after an account closes; to suggest nearby games and courts from an approximate location; and to improve the Service. You can object to this processing.
- Consent: to use your device location. You can withdraw it at any time in your browser settings.
- Legal obligation and legal claims: to meet legal requirements and to establish, exercise or defend claims.
9. Location
When our hosting provider supplies an approximate city based on your IP address, we use it to suggest nearby games and courts. This estimate can be wrong, especially when using a VPN or mobile network. You can choose another city or show all areas. We do not save this inferred location in your account or application database. Provider access logs follow the retention periods below.
On your first landing-page visit we show an approximate IP-based area where supported and ask your browser for location permission. If you grant it, we use device coordinates to find nearby listings and send the coordinates to Google Geocoding to identify your city. If permission is declined or location is unavailable, we keep the approximate area. An area you explicitly choose takes priority. You can also use “Use my location” to try again.
We do not save these device coordinates in your account during public browsing. Public search links can include the coordinates you selected; anyone you share that link with can read them. Choose a city instead when you prefer to share only a general area.
The search area you set in your profile is private and used only to find games and players near you. For games we retain the Google place ID, venue name, formatted address, coordinates and IANA timezone. Profiles retain city, country and an optional place ID; raw autocomplete responses are not stored.
10. What other people can see
- Anyone, including signed-out visitors: centre pages; approved coach pages, including the coach's username, photos, headline, description, qualifications, services, prices, venues, contact details, home city, skill rating and league; coach reviews with the reviewer's username, rating and comment; the monthly leaderboards, which show each player with a ranked result that month by username, leaderboard city (the city of their most recently played ranked game, or their home city before their first), league, league points, season wins and skill rating; and, for upcoming public games, the venue, time, format, level band, price and places left. Never the street address, host or participants of a game, or invite-only games. Tournament pages show the username of every registered player, the scores and the standings, before and during play and once completed.
- Signed-in members: your username, home city, skill, league, availability and match history. Your search area and precise coordinates are private. Upcoming invite-only games, invitations and game chat remain limited to authorised participants; completed private matches still show participants and winner in profile history.
- Centres: the username, email and booking details of people who book their courts, and centre chat messages. Centres see bookings for their own courts only.
- Coaches: the username, lesson details and note of players who request lessons, and coach chat messages.
Blocking someone stops new direct contact, invitations and friend requests between you.
13. International transfers
XPO8 is based in Hong Kong. The padelduels website, application and database run in Ohio, in the United States, on Vercel, Google Cloud and Supabase. Photos and other uploaded files are stored in Google Cloud's Frankfurt region. Our other providers may process data in the European Union, the United States, Hong Kong and other countries. Where the law requires safeguards for these transfers, we rely on measures such as the European Commission's standard contractual clauses, which our main providers include in their data processing terms.
14. Retention
- Account and profile data: while your account is open.
- Delivery logs: 30 days.
- Provider access logs: no more than 90 days, configured with the provider.
- Resolved moderation evidence: 12 months; open cases remain until resolved.
- Inactive direct and game chat: 12 months, measured from the conversation or game chat's latest activity.
- Booking, lesson and payment records: kept after an account closes under a pseudonymous identifier, so centres, coaches and we can handle refunds, disputes and accounts. The username and email on a court booking stay in the centre's records.
- Backups containing deleted data: removed within 35 days under the production backup policy.
Stripe keeps payment records under its own retention rules.
15. Closing your account
Closing your account in Settings hides the profile and disables access immediately. Future games you host are cancelled and places in other future games reopen without attendance penalties. Your coach listing and its photos are removed. Direct identifiers are pseudonymized within 30 days. Competition and administrative history remains under a pseudonymous identifier so standings, corrections and safety decisions stay auditable.
16. Security
We use encryption in transit, access rules enforced by the database on every request, audited administrator actions that each require a reason, and managed storage for secrets. Card details are handled by Stripe and never reach our servers. No method of transmission or storage is completely secure, so keep your password safe and tell us at contact@padelduels.com if you think your account has been misused. Report security vulnerabilities to the same address.
17. Your choices and rights
You can update your profile, availability and search area, block players, and close your account in Settings. You can see your reports and attendance appeals there too.
Depending on where you live, you may also have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. Under Hong Kong law you can request access to and correction of your data.
You can complain to Hong Kong's Privacy Commissioner for Personal Data or the data protection authority where you live or work. We would appreciate the chance to resolve your concern first.
18. How we handle privacy requests
- Email contact@padelduels.com from the address on your account, saying what you would like us to do.
- We may ask you to confirm your identity, or your authority if you are acting for someone else.
- We reply within one month. If a request is complex, we will tell you if we need longer and why.
- Some information may be kept where we need it, such as pseudonymous competition history, safety records, or records needed for refunds, disputes or legal claims. We will explain what we keep and why.
- For records a centre or coach holds in its own systems, we may refer you to them or pass your request on.
19. Communications
We send in-app notifications and emails that are part of the Service: invitations, join decisions, removals and cancellations, result submissions and disputes, attendance cases, restriction changes, booking and lesson updates, and a reminder 24 hours before a game, with another in the app 2 hours before. Sign-in and password emails come from our authentication provider. We do not send marketing email; if that changes, we will ask first where the law requires it, and every message will include a way to unsubscribe.
20. Children
padelduels is for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you believe someone under 16 has created an account, contact us at contact@padelduels.com and we will close it.
21. Changes to this policy
We may update this policy, and the date at the top shows when it last changed. For material changes, we tell you in advance by email or in the Service.
22. Contact us
XPO8 Limited
1603, The L. Plaza, 367–375 Queen's Road Central
Sheung Wan, Hong Kong Island, Hong Kong
contact@padelduels.com
Include your account email so we can find your records quickly.
See also the terms of service and the help and community rules.